Spyware / Malware / Virus Removal

[Resolved] Task manager greyed out

24 min read

Looking for the outcome? Ask AI

BlondieS

Post #46February 4, 2008, 1:17 AM UTC

Looks like it is still freezing. I left it for over 10 minutes

LDTate

Post #47February 4, 2008, 1:18 AM UTC

OK. Lets try the combofix you downloaded before

BlondieS

Post #48February 4, 2008, 1:44 AM UTC

Combo fix ran and restart the PC. It booted in normal mode. I got a warning about the system configuration utility (is that the things that I unchecked in startup in 'msconfig') Should I post the combo fix log?

LDTate

Post #49February 4, 2008, 1:45 AM UTC

Combo fix ran and restart the PC.

It booted in normal mode.

I got a warning about the system configuration utility (is that the things that I unchecked in startup in 'msconfig')

Should I post the combo fix log?

Yes, post it

BlondieS

Post #50February 4, 2008, 1:54 AM UTC

ComboFix 08-01-30.1 - Stephen 2008-02-04 1:26:34.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.785 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Program Files\Internet Explorer\IEXPLORE32.Sys
C:\Program Files\Internet Explorer\PLUGINS\Sy_Win7k.Jmp
C:\Program Files\internet explorer\plugins\wn_sys8x.sys
C:\WINDOWS\235780MM.DLL
C:\WINDOWS\Fonts\avzxoin.dll
C:\WINDOWS\Fonts\chrebur.fon
C:\WINDOWS\Fonts\gejibnd.fon
C:\WINDOWS\Fonts\jshubxw.fon
C:\WINDOWS\Fonts\jsqxcss.dll
C:\WINDOWS\Fonts\rarjfni.dll
C:\WINDOWS\Fonts\rsjzbfg.dll
C:\WINDOWS\hosts
C:\WINDOWS\jwlvoxku.dll
C:\WINDOWS\system32\3auhad.dll
C:\WINDOWS\system32\auhad.dll
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\bhmsyfkzyzj.dll
C:\WINDOWS\system32\DbgHlp32.dll
C:\WINDOWS\system32\fjotafkzyzj.dll
C:\WINDOWS\system32\glqvchfzyzj.dll
C:\WINDOWS\system32\gnaixnauhqq.dll
C:\WINDOWS\system32\gnaixnauhuoyizqq.dll
C:\WINDOWS\system32\gnolnait.dll
C:\WINDOWS\system32\hjxr.dll
C:\WINDOWS\system32\IGB_CQSJ_1008.dll
C:\WINDOWS\system32\IGB_DJOL_1019.dll
C:\WINDOWS\system32\IGB_FY_1022.dll
C:\WINDOWS\system32\IGB_GFSJ_1020.dll
C:\WINDOWS\system32\IGB_TMZ_1023.dll
C:\WINDOWS\system32\IGB_TMZ_1025.dll
C:\WINDOWS\system32\IGB_WD_1026.dll
C:\WINDOWS\system32\IGB_WLWZ_1023.dll
C:\WINDOWS\system32\IGB_WMGJ_1025.dll
C:\WINDOWS\system32\IGB_ZX_1019.dll
C:\WINDOWS\system32\ijougiemnaw.dll
C:\WINDOWS\system32\imsxdinzyzj.dll
C:\WINDOWS\system32\kvsc3.dll
C:\WINDOWS\system32\LotusHlp.dll
C:\WINDOWS\system32\lyloader.exe
C:\WINDOWS\system32\lymangr.dll
C:\WINDOWS\system32\MSDEG32.DLL
C:\WINDOWS\system32\niluw.dll
C:\WINDOWS\system32\nsxclpuzyzj.dll
C:\WINDOWS\system32\nvdispdrv.dll
C:\WINDOWS\system32\PTSShell.dll
C:\WINDOWS\system32\qvagnsxzyzj.dll
C:\WINDOWS\system32\SHAProc.dll
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\system32\utgnehz.dll
C:\WINDOWS\system32\vlihzouhgnfe.dll
C:\WINDOWS\system32\ydinuafzyzj.dll
C:\WINDOWS\vvvvirgq.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-03 23:20 . 2008-02-03 23:20 d——– C:\Documents and Settings\Stephen\Application Data\Malwarebytes
2008-02-01 17:39 . 2008-02-03 23:17 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-02-01 17:34 . 2008-02-01 17:34 30,720 –a—— C:\WINDOWS\SYSTEM32\ugtzef.dll
2008-02-01 17:34 . 2008-02-01 17:34 28,160 –a—— C:\WINDOWS\SYSTEM32\wnhipe.dll
2008-02-01 17:32 . 2008-02-01 17:32 30,208 –a—— C:\WINDOWS\SYSTEM32\rmacjf.dll
2008-02-01 17:31 . 2008-02-01 17:31 34,816 –a—— C:\WINDOWS\SYSTEM32\bdnaim.dll
2008-02-01 17:31 . 2008-02-01 17:31 29,184 –a—— C:\WINDOWS\SYSTEM32\nijndn.dll
2008-02-01 17:30 . 2008-02-01 17:30 31,232 –a—— C:\WINDOWS\SYSTEM32\foxusx.dll
2008-02-01 17:28 . 2000-02-01 16:50 20,795 –a—— C:\WINDOWS\gxkvrk.exe
2008-02-01 16:48 . 2008-02-01 00:32 20,795 –a—— C:\WINDOWS\jbxtfo.exe
2008-01-31 22:56 . 2008-01-31 22:56 30,720 –a—— C:\WINDOWS\SYSTEM32\jrblgu.dll
2008-01-31 22:56 . 2008-01-31 22:56 28,160 –a—— C:\WINDOWS\SYSTEM32\uvesfq.dll
2008-01-31 22:54 . 2008-01-31 22:54 30,208 –a—— C:\WINDOWS\SYSTEM32\najiaa.dll
2008-01-31 22:53 . 2008-01-31 22:53 34,816 –a—— C:\WINDOWS\SYSTEM32\kuhqax.dll
2008-01-31 22:53 . 2008-01-31 22:53 29,184 –a—— C:\WINDOWS\SYSTEM32\tuzyrt.dll
2008-01-31 22:52 . 2008-01-31 22:52 31,232 –a—— C:\WINDOWS\SYSTEM32\oewvhw.dll
2008-01-31 19:32 . 2008-01-31 19:32 30,720 –a—— C:\WINDOWS\SYSTEM32\kdtzrx.dll
2008-01-31 19:32 . 2008-01-31 19:32 28,160 –a—— C:\WINDOWS\SYSTEM32\jhybak.dll
2008-01-31 19:30 . 2008-01-31 19:30 30,208 –a—— C:\WINDOWS\SYSTEM32\rbopga.dll
2008-01-31 19:30 . 2008-01-31 19:30 29,184 –a—— C:\WINDOWS\SYSTEM32\ilpipg.dll
2008-01-31 19:29 . 2008-01-31 19:29 34,816 –a—— C:\WINDOWS\SYSTEM32\juqkhb.dll
2008-01-31 19:28 . 2008-01-31 19:28 31,232 –a—— C:\WINDOWS\SYSTEM32\svpvdm.dll
2008-01-31 19:26 . 2008-01-31 16:56 20,795 –a—— C:\WINDOWS\sgbcxx.exe
2008-01-31 17:00 . 2008-01-31 17:00 28,160 –a—— C:\WINDOWS\SYSTEM32\nkmnrq.dll
2008-01-31 16:59 . 2008-01-31 16:59 30,720 –a—— C:\WINDOWS\SYSTEM32\tduvwb.dll
2008-01-31 16:57 . 2008-01-31 16:57 30,208 –a—— C:\WINDOWS\SYSTEM32\xnmqwu.dll
2008-01-31 16:57 . 2008-01-31 16:57 29,184 –a—— C:\WINDOWS\SYSTEM32\dcczin.dll
2008-01-31 16:56 . 2008-01-31 16:56 34,816 –a—— C:\WINDOWS\SYSTEM32\nylsqy.dll
2008-01-31 16:56 . 2008-01-31 16:56 31,232 –a—— C:\WINDOWS\SYSTEM32\ollhro.dll
2008-01-31 15:19 . 2008-01-31 15:19 30,720 –a—— C:\WINDOWS\SYSTEM32\wtajve.dll
2008-01-31 15:19 . 2008-01-31 15:19 28,160 –a—— C:\WINDOWS\SYSTEM32\uzvjjj.dll
2008-01-31 15:18 . 2008-01-31 15:18 30,208 –a—— C:\WINDOWS\SYSTEM32\hfbcap.dll
2008-01-31 15:17 . 2008-01-31 15:17 29,184 –a—— C:\WINDOWS\SYSTEM32\gnunwl.dll
2008-01-31 15:16 . 2008-01-31 15:16 34,816 –a—— C:\WINDOWS\SYSTEM32\pbatsa.dll
2008-01-31 15:16 . 2008-01-31 15:16 31,232 –a—— C:\WINDOWS\SYSTEM32\vscwcr.dll
2008-01-31 11:56 . 2008-01-31 11:56 28,160 –a—— C:\WINDOWS\SYSTEM32\zmlxfh.dll
2008-01-31 11:55 . 2008-01-31 11:55 30,720 –a—— C:\WINDOWS\SYSTEM32\rrkddl.dll
2008-01-31 11:54 . 2008-01-31 11:54 30,208 –a—— C:\WINDOWS\SYSTEM32\andwwm.dll
2008-01-31 11:53 . 2008-01-31 11:53 29,184 –a—— C:\WINDOWS\SYSTEM32\cxniah.dll
2008-01-31 11:50 . 2008-01-30 22:20 20,795 –a—— C:\WINDOWS\mzlafx.exe
2008-01-30 22:24 . 2008-01-30 22:24 30,720 –a—— C:\WINDOWS\SYSTEM32\zkcwbi.dll
2008-01-30 22:24 . 2008-01-30 22:24 28,160 –a—— C:\WINDOWS\SYSTEM32\dcjebp.dll
2008-01-30 22:22 . 2008-01-30 22:22 30,208 –a—— C:\WINDOWS\SYSTEM32\neukpb.dll
2008-01-30 22:21 . 2008-01-30 22:21 34,816 –a—— C:\WINDOWS\SYSTEM32\djozjq.dll
2008-01-30 22:21 . 2008-01-30 22:21 29,184 –a—— C:\WINDOWS\SYSTEM32\riavne.dll
2008-01-30 22:20 . 2008-01-30 22:20 31,232 –a—— C:\WINDOWS\SYSTEM32\zibgjd.dll
2008-01-30 20:43 . 2008-01-30 20:43 32,768 –a—— C:\WINDOWS\SYSTEM32\qqldkg.dll
2008-01-30 19:04 . 2008-01-30 19:04 30,720 –a—— C:\WINDOWS\SYSTEM32\qexsjm.dll
2008-01-30 19:04 . 2008-01-30 19:04 28,160 –a—— C:\WINDOWS\SYSTEM32\qnnlgq.dll
2008-01-30 19:02 . 2008-01-30 19:02 30,208 –a—— C:\WINDOWS\SYSTEM32\acwluu.dll
2008-01-30 19:02 . 2008-01-30 19:02 29,184 –a—— C:\WINDOWS\SYSTEM32\wzkzeg.dll
2008-01-30 19:01 . 2008-01-30 19:01 34,816 –a—— C:\WINDOWS\SYSTEM32\lbjbjp.dll
2008-01-30 19:00 . 2008-01-30 19:00 31,232 –a—— C:\WINDOWS\SYSTEM32\ybtykw.dll
2008-01-30 17:23 . 2008-01-30 17:23 32,768 –a—— C:\WINDOWS\SYSTEM32\ixspwk.dll
2008-01-30 15:44 . 2008-01-30 15:44 30,720 –a—— C:\WINDOWS\SYSTEM32\cgiqpn.dll
2008-01-30 15:44 . 2008-01-30 15:44 28,160 –a—— C:\WINDOWS\SYSTEM32\bvnjwp.dll
2008-01-30 15:42 . 2008-01-30 15:42 30,208 –a—— C:\WINDOWS\SYSTEM32\shjbqg.dll
2008-01-30 15:41 . 2008-01-30 15:41 34,816 –a—— C:\WINDOWS\SYSTEM32\iedjkw.dll
2008-01-30 15:41 . 2008-01-30 15:41 29,184 –a—— C:\WINDOWS\SYSTEM32\tiqura.dll
2008-01-30 15:40 . 2008-01-30 15:40 31,232 –a—— C:\WINDOWS\SYSTEM32\vvbcjl.dll
2008-01-29 17:14 . 2008-01-29 17:14 30,720 –a—— C:\WINDOWS\SYSTEM32\xexzoi.dll
2008-01-29 17:14 . 2008-01-29 17:14 28,160 –a—— C:\WINDOWS\SYSTEM32\yiabnf.dll
2008-01-29 17:12 . 2008-01-29 17:12 30,208 –a—— C:\WINDOWS\SYSTEM32\qgkhxg.dll
2008-01-29 17:11 . 2008-01-29 17:11 34,816 –a—— C:\WINDOWS\SYSTEM32\sjillo.dll
2008-01-29 17:10 . 2008-01-29 17:10 31,232 –a—— C:\WINDOWS\SYSTEM32\dmjknp.dll
2008-01-29 15:33 . 2008-01-29 15:33 32,768 –a—— C:\WINDOWS\SYSTEM32\dikjbp.dll
2008-01-29 13:55 . 2008-01-29 13:55 28,160 –a—— C:\WINDOWS\SYSTEM32\xgqyin.dll
2008-01-29 13:54 . 2008-01-29 13:54 30,720 –a—— C:\WINDOWS\SYSTEM32\qsewzd.dll
2008-01-29 13:52 . 2008-01-29 13:52 30,208 –a—— C:\WINDOWS\SYSTEM32\fyduip.dll
2008-01-29 13:52 . 2008-01-29 13:52 29,184 –a—— C:\WINDOWS\SYSTEM32\wxejys.dll
2008-01-29 13:51 . 2008-01-29 13:51 34,816 –a—— C:\WINDOWS\SYSTEM32\ylitzv.dll
2008-01-29 13:50 . 2008-01-29 13:50 31,232 –a—— C:\WINDOWS\SYSTEM32\vmlxwi.dll
2008-01-29 12:12 . 2008-02-01 17:31 29,557 —hs—- C:\WINDOWS\235780M.exe
2008-01-29 10:30 . 2008-01-29 10:30 30,720 –a—— C:\WINDOWS\SYSTEM32\drtcuk.dll
2008-01-29 10:30 . 2008-01-29 10:30 28,160 –a—— C:\WINDOWS\SYSTEM32\vnamut.dll
2008-01-29 10:28 . 2008-01-29 10:28 30,208 –a—— C:\WINDOWS\SYSTEM32\sbztaw.dll
2008-01-29 10:28 . 2008-01-29 10:28 29,184 –a—— C:\WINDOWS\SYSTEM32\kdfdpm.dll
2008-01-29 10:27 . 2008-01-29 10:27 34,816 –a—— C:\WINDOWS\SYSTEM32\nophty.dll
2008-01-29 10:27 . 2008-01-29 10:27 31,232 –a—— C:\WINDOWS\SYSTEM32\auyghd.dll
2008-01-29 10:24 . 2008-01-28 22:32 20,795 –a—— C:\WINDOWS\enwyuy.exe
2008-01-28 22:35 . 2008-01-28 22:35 30,720 –a—— C:\WINDOWS\SYSTEM32\ehyxub.dll
2008-01-28 22:34 . 2008-01-28 22:34 32,768 –a—— C:\WINDOWS\SYSTEM32\bxreyo.dll
2008-01-28 22:34 . 2008-01-28 22:34 30,208 –a—— C:\WINDOWS\SYSTEM32\sasesr.dll
2008-01-28 22:33 . 2008-01-28 22:33 29,184 –a—— C:\WINDOWS\SYSTEM32\eqfxeb.dll
2008-01-28 22:32 . 2008-01-28 22:32 34,816 –a—— C:\WINDOWS\SYSTEM32\ngmjfw.dll
2008-01-28 22:32 . 2008-01-28 22:32 31,232 –a—— C:\WINDOWS\SYSTEM32\uxelfq.dll
2008-01-28 20:56 . 2008-01-28 20:56 30,720 –a—— C:\WINDOWS\SYSTEM32\qmdnfd.dll
2008-01-28 20:56 . 2008-01-28 20:56 28,160 –a—— C:\WINDOWS\SYSTEM32\egdqfx.dll
2008-01-28 20:54 . 2008-01-28 20:54 30,208 –a—— C:\WINDOWS\SYSTEM32\vdnhal.dll
2008-01-28 20:53 . 2008-01-28 20:53 34,816 –a—— C:\WINDOWS\SYSTEM32\fgmzxf.dll
2008-01-28 20:53 . 2008-01-28 20:53 29,184 –a—— C:\WINDOWS\SYSTEM32\wuoioo.dll
2008-01-28 20:52 . 2008-01-28 20:52 31,232 –a—— C:\WINDOWS\SYSTEM32\hfoyyr.dll
2008-01-28 19:15 . 2008-01-28 19:15 30,720 –a—— C:\WINDOWS\SYSTEM32\muovux.dll
2008-01-28 19:15 . 2008-01-28 19:15 28,160 –a—— C:\WINDOWS\SYSTEM32\qkehkb.dll
2008-01-28 19:14 . 2008-01-28 19:14 32,768 –a—— C:\WINDOWS\SYSTEM32\jvhjkx.dll
2008-01-28 19:13 . 2008-01-28 19:13 34,816 –a—— C:\WINDOWS\SYSTEM32\xntaew.dll
2008-01-28 19:13 . 2008-01-28 19:13 30,208 –a—— C:\WINDOWS\SYSTEM32\lifycc.dll
2008-01-28 19:13 . 2008-01-28 19:13 29,184 –a—— C:\WINDOWS\SYSTEM32\ypaylj.dll
2008-01-28 19:12 . 2008-01-28 19:12 31,232 –a—— C:\WINDOWS\SYSTEM32\xvgacw.dll
2008-01-28 17:29 . 2008-01-27 22:05 20,795 –a—— C:\WINDOWS\fgrdds.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 18:29 ——— d—–w C:\Documents and Settings\Stephen\Application Data\Skype
2008-02-01 17:33 15,487 —-a-w C:\WINDOWS\Fonts\jsqxczc.exe
2008-02-01 17:32 16,603 —-a-w C:\WINDOWS\Fonts\avzxost.exe
2008-02-01 17:32 16,144 —-a-w C:\WINDOWS\Fonts\rsjzbsp.exe
2008-02-01 17:31 15,065 —-a-w C:\WINDOWS\Fonts\rarjftl.exe
2008-02-01 17:29 ——— d—–w C:\Documents and Settings\Stephen\Application Data\AVG7
2008-02-01 17:28 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-01 00:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-29 17:10 20,795 —-a-w C:\WINDOWS\bbaeki.exe
2008-01-27 19:23 11,264 —-a-w C:\WINDOWS\system32\drivers\msaclue.sys
2008-01-27 19:21 10,193 –sh–w C:\WINDOWS\vvrqitok.exe
2008-01-27 17:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-26 20:20 10,168 –sh–w C:\WINDOWS\owvykwmcw.exe
2008-01-03 14:51 ——— d—–w C:\Program Files\CCP
2007-12-29 19:53 ——— d—–w C:\Program Files\DivX
2007-11-28 19:30 26,624 –sh–r C:\soS.Exe
2006-06-18 10:42 44,872 —-a-w C:\Documents and Settings\Stephen\Application Data\GDIPFONTCACHEV1.DAT
2004-09-02 19:33 0 —ha-w C:\Documents and Settings\Stephen\hpothb07.dat
2004-08-04 18:47 2,120,185 ——w C:\WINDOWS\Fonts\jsqxcyc.dll
2004-08-04 18:46 527,968 ——w C:\WINDOWS\Fonts\avzxomn.dll
2004-08-04 18:46 526,438 ——w C:\WINDOWS\Fonts\rsjzbpm.dll
2004-08-04 18:45 523,890 ——w C:\WINDOWS\Fonts\rarjfpi.dll
2003-08-12 15:29 32 –sha-w C:\WINDOWS\{D30393F2-AD80-47FA-9F4C-49D575DDAC52}.dat
2003-08-12 15:29 32 –sha-w C:\WINDOWS\SYSTEM32\{03765FB0-9D62-4CF2-ACA4-0292DD0C7D68}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:56 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 07:56 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 17:19 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"owvykwmcw"= owvykwmcw.exe

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{006E0988-9758-4887-9755-C8761F5FDE61}"= [ ]
"{6598FF45-DA60-F48A-BC43-10AC47853D56}"= C:\WINDOWS\Fonts\rarjfpi.dll [2004-08-04 18:45 523890]
"{F859245F-345D-BC13-AC4F-145D47DA34FF}"= C:\WINDOWS\Fonts\avzxomn.dll [2004-08-04 18:46 527968]
"{22FAACDE-34DA-CCD4-AB4D-DA34485A3422}"= C:\WINDOWS\Fonts\rsjzbpm.dll [2004-08-04 18:46 526438]
"{3D098345-9012-8750-8910-9128098134D3}"= C:\WINDOWS\Fonts\jsqxcyc.dll [2004-08-04 18:47 2120185]
"{7d8d71e0-e8db-4b7f-8236-2c2c91883044}"= C:\WINDOWS\system32\IGB_DJOL_1019.dll [ ]
"{a3d7c0d2-8c19-48c6-92c9-e1c0cccccd66}"= C:\WINDOWS\system32\IGB_CQSJ_1008.dll [ ]
"{76255dcf-d686-4d89-82d1-78fef7b3dc00}"= C:\WINDOWS\system32\IGB_WD_1026.dll [ ]
"{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}"= C:\WINDOWS\system32\hhrdxd.dll [2008-01-27 19:21 148137]
"{9807ac38-fd55-4c8f-9621-439ea7772f0d}"= C:\WINDOWS\system32\IGB_ZX_1019.dll [ ]
"{38bc7b80-9478-46e6-ab8b-51a671c74e26}"= C:\WINDOWS\system32\IGB_WMGJ_1025.dll [ ]
"{627a018a-1c4f-4e0e-9355-6f0cb21b0139}"= C:\WINDOWS\system32\IGB_WLWZ_1023.dll [ ]
"{7bd96c82-5433-42b1-b316-8a55c58b2b0f}"= C:\WINDOWS\system32\IGB_GFSJ_1020.dll [ ]
"{57034a0c-a6c1-4209-a47f-14c3b826dd1e}"= C:\WINDOWS\system32\IGB_TMZ_1025.dll [ ]
"{5900d1d4-2e8d-4dda-964d-4605477a98a8}"= C:\WINDOWS\system32\IGB_FY_1022.dll [ ]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG111v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
–a—— 2002-12-17 11:28 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
–a—— 2008-01-27 17:19 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
——— 2004-08-04 07:56 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2003-12-02 16:11 54296 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
–a—— 2003-12-02 16:11 58392 C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDet]
–a—— 2002-09-30 00:00 45056 C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 07:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2003-02-20 15:45 28672 C:\WINDOWS\SYSTEM32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
–a—— 2002-10-29 08:18 49152 C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
-ra—— 2002-08-14 17:22 28672 C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-02-23 15:45 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
–a—— 2003-08-18 16:46 53248 C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2005-04-01 15:16 5562368 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2005-04-01 15:16 86016 C:\WINDOWS\System32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2005-04-01 15:16 1495040 C:\WINDOWS\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
–a—— 2007-01-12 13:57 25367592 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
——— 2006-10-18 19:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe

R2 mseqsy;mseqsy;C:\WINDOWS\system32\DRIVERS\msacpe.sys [2008-02-01 17:32]
R2 msskye;msskye;C:\WINDOWS\system32\DRIVERS\msaclue.sys [2008-01-27 19:23]
S3 oflpydin;oflpydin;C:\DOCUME~1\Family\LOCALS~1\Temp\oflpydin.sys []
S3 phy;phy;C:\WINDOWS\system32\DRIVERS\phy.sys [2008-01-26 20:19]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 16:53]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\soS.Exe
\Shell\open\ComMand - C:\soS.Exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04bd9d96-09c5-11da-84a1-0007e926336f}]
\Shell\AutoRun\command - E:\reper.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953398f6-825b-11dc-86ef-001060d0ebc6}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953398f7-825b-11dc-86ef-001060d0ebc6}]
\Shell\AutoRun\command - G:\soS.Exe
\Shell\open\ComMand - G:\soS.Exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9dd50c86-c9d9-11dc-879f-001060d0ebc6}]
\Shell\AutoRun\command - F:\soS.Exe
\Shell\open\ComMand - F:\soS.Exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 17:59:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2004-09-01 21:27:54 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1071684436.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-01-18 20:47:53 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 01:37:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\RtlGina2.dll

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\Fonts\rarjfpi.dll
-> C:\WINDOWS\Fonts\avzxomn.dll
-> C:\WINDOWS\Fonts\rsjzbpm.dll
-> C:\WINDOWS\Fonts\jsqxcyc.dll
-> C:\WINDOWS\system32\hhrdxd.dll
-> C:\WINDOWS\vvvvirgq.dll
-> C:\WINDOWS\jwlvoxku.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\owvykwmcw.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
.
**************************************************************************
.
Completion time: 2008-02-04 1:43:28 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-04 01:43:20
.
2008-01-25 19:05:19 — E O F —

LDTate

Post #51February 4, 2008, 2:17 AM UTC

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\SYSTEM32\ugtzef.dll
C:\WINDOWS\SYSTEM32\wnhipe.dll
C:\WINDOWS\SYSTEM32\rmacjf.dll
C:\WINDOWS\SYSTEM32\bdnaim.dll
C:\WINDOWS\SYSTEM32\nijndn.dll
C:\WINDOWS\SYSTEM32\foxusx.dll
C:\WINDOWS\gxkvrk.exe
C:\WINDOWS\jbxtfo.exe
C:\WINDOWS\SYSTEM32\jrblgu.dll
C:\WINDOWS\SYSTEM32\uvesfq.dll
C:\WINDOWS\SYSTEM32\najiaa.dll
C:\WINDOWS\SYSTEM32\kuhqax.dll
C:\WINDOWS\SYSTEM32\tuzyrt.dll
C:\WINDOWS\SYSTEM32\oewvhw.dll
C:\WINDOWS\SYSTEM32\kdtzrx.dll
C:\WINDOWS\SYSTEM32\jhybak.dll
C:\WINDOWS\SYSTEM32\rbopga.dll
C:\WINDOWS\SYSTEM32\ilpipg.dll
C:\WINDOWS\SYSTEM32\juqkhb.dll
C:\WINDOWS\SYSTEM32\svpvdm.dll
C:\WINDOWS\sgbcxx.exe
C:\WINDOWS\SYSTEM32\nkmnrq.dll
C:\WINDOWS\SYSTEM32\tduvwb.dll
C:\WINDOWS\SYSTEM32\xnmqwu.dll
C:\WINDOWS\SYSTEM32\dcczin.dll
C:\WINDOWS\SYSTEM32\nylsqy.dll
C:\WINDOWS\SYSTEM32\ollhro.dll
C:\WINDOWS\SYSTEM32\wtajve.dll
C:\WINDOWS\SYSTEM32\uzvjjj.dll
C:\WINDOWS\SYSTEM32\hfbcap.dll
C:\WINDOWS\SYSTEM32\gnunwl.dll
C:\WINDOWS\SYSTEM32\pbatsa.dll
C:\WINDOWS\SYSTEM32\vscwcr.dll
C:\WINDOWS\SYSTEM32\zmlxfh.dll
C:\WINDOWS\SYSTEM32\rrkddl.dll
C:\WINDOWS\SYSTEM32\andwwm.dll
C:\WINDOWS\SYSTEM32\cxniah.dll
C:\WINDOWS\mzlafx.exe
C:\WINDOWS\SYSTEM32\zkcwbi.dll
C:\WINDOWS\SYSTEM32\dcjebp.dll
C:\WINDOWS\SYSTEM32\neukpb.dll
C:\WINDOWS\SYSTEM32\djozjq.dll
C:\WINDOWS\SYSTEM32\riavne.dll
C:\WINDOWS\SYSTEM32\zibgjd.dll
C:\WINDOWS\SYSTEM32\qqldkg.dll
C:\WINDOWS\SYSTEM32\qexsjm.dll
C:\WINDOWS\SYSTEM32\qnnlgq.dll
C:\WINDOWS\SYSTEM32\acwluu.dll
C:\WINDOWS\SYSTEM32\wzkzeg.dll
C:\WINDOWS\SYSTEM32\lbjbjp.dll
C:\WINDOWS\SYSTEM32\ybtykw.dll
C:\WINDOWS\SYSTEM32\ixspwk.dll
C:\WINDOWS\SYSTEM32\cgiqpn.dll
C:\WINDOWS\SYSTEM32\bvnjwp.dll
C:\WINDOWS\SYSTEM32\shjbqg.dll
C:\WINDOWS\SYSTEM32\iedjkw.dll
C:\WINDOWS\SYSTEM32\tiqura.dll
C:\WINDOWS\SYSTEM32\vvbcjl.dll
C:\WINDOWS\SYSTEM32\xexzoi.dll
C:\WINDOWS\SYSTEM32\yiabnf.dll
C:\WINDOWS\SYSTEM32\qgkhxg.dll
C:\WINDOWS\SYSTEM32\sjillo.dll
C:\WINDOWS\SYSTEM32\dmjknp.dll
C:\WINDOWS\SYSTEM32\dikjbp.dll
C:\WINDOWS\SYSTEM32\xgqyin.dll
C:\WINDOWS\SYSTEM32\qsewzd.dll
C:\WINDOWS\SYSTEM32\fyduip.dll
C:\WINDOWS\SYSTEM32\wxejys.dll
C:\WINDOWS\SYSTEM32\ylitzv.dll
C:\WINDOWS\SYSTEM32\vmlxwi.dll
C:\WINDOWS\235780M.exe
C:\WINDOWS\SYSTEM32\drtcuk.dll
C:\WINDOWS\SYSTEM32\vnamut.dll
C:\WINDOWS\SYSTEM32\sbztaw.dll
C:\WINDOWS\SYSTEM32\kdfdpm.dll
C:\WINDOWS\SYSTEM32\nophty.dll
C:\WINDOWS\SYSTEM32\auyghd.dll
C:\WINDOWS\enwyuy.exe
C:\WINDOWS\SYSTEM32\ehyxub.dll
C:\WINDOWS\SYSTEM32\bxreyo.dll
C:\WINDOWS\SYSTEM32\sasesr.dll
C:\WINDOWS\SYSTEM32\eqfxeb.dll
C:\WINDOWS\SYSTEM32\ngmjfw.dll
C:\WINDOWS\SYSTEM32\uxelfq.dll
C:\WINDOWS\SYSTEM32\qmdnfd.dll
C:\WINDOWS\SYSTEM32\egdqfx.dll
C:\WINDOWS\SYSTEM32\vdnhal.dll
C:\WINDOWS\SYSTEM32\fgmzxf.dll
C:\WINDOWS\SYSTEM32\wuoioo.dll
C:\WINDOWS\SYSTEM32\hfoyyr.dll
C:\WINDOWS\SYSTEM32\muovux.dll
C:\WINDOWS\SYSTEM32\qkehkb.dll
C:\WINDOWS\SYSTEM32\jvhjkx.dll
C:\WINDOWS\SYSTEM32\xntaew.dll
C:\WINDOWS\SYSTEM32\lifycc.dll
C:\WINDOWS\SYSTEM32\xvgacw.dll
C:\WINDOWS\fgrdds.exe
C:\WINDOWS\Fonts\jsqxczc.exe
C:\WINDOWS\Fonts\avzxost.exe
C:\WINDOWS\Fonts\rsjzbsp.exe
C:\WINDOWS\Fonts\rarjftl.exe
C:\WINDOWS\bbaeki.exe
C:\WINDOWS\vvrqitok.exe
C:\WINDOWS\owvykwmcw.exe
C:\soS.Exe
C:\WINDOWS\Fonts\jsqxcyc.dll
C:\WINDOWS\Fonts\avzxomn.dll
C:\WINDOWS\Fonts\rsjzbpm.dll
C:\WINDOWS\Fonts\rarjfpi.dll
C:\WINDOWS\{D30393F2-AD80-47FA-9F4C-49D575DDAC52}.dat
C:\WINDOWS\SYSTEM32\{03765FB0-9D62-4CF2-ACA4-0292DD0C7D68}.dat
C:\WINDOWS\system32\hhrdxd.dll 
C:\DOCUME~1\Family\LOCALS~1\Temp\oflpydin.sys
C:\WINDOWS\system32\DRIVERS\phy.sys

Driver::
phy

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"owvykwmcw"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{006E0988-9758-4887-9755-C8761F5FDE61}"=-
"{6598FF45-DA60-F48A-BC43-10AC47853D56}"=- 
"{F859245F-345D-BC13-AC4F-145D47DA34FF}"=- 
"{22FAACDE-34DA-CCD4-AB4D-DA34485A3422}"=- 
"{3D098345-9012-8750-8910-9128098134D3}"=- 
"{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04bd9d96-09c5-11da-84a1-0007e926336f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953398f7-825b-11dc-86ef-001060d0ebc6}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9dd50c86-c9d9-11dc-879f-001060d0ebc6}]

Save this as Save this as "CFScript"

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

BlondieS

Post #52February 4, 2008, 2:24 AM UTC

Dragged it into Combi and it's about to run. Does I disconnect from the internet first?

LDTate

Post #53February 4, 2008, 2:25 AM UTC

Dragged it into Combi and it's about to run.

Does I disconnect from the internet first?

no. just let it do it's thing

BlondieS

Post #54February 4, 2008, 3:16 AM UTC

combi fix log

ComboFix 08-01-30.1 - Stephen 2008-02-04 2:27:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.587 [GMT 0:00]
Running from: C:\Documents and Settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: C:\Documents and Settings\Stephen\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\DOCUME~1\Family\LOCALS~1\Temp\oflpydin.sys
C:\soS.Exe
C:\WINDOWS\{D30393F2-AD80-47FA-9F4C-49D575DDAC52}.dat
C:\WINDOWS\235780M.exe
C:\WINDOWS\bbaeki.exe
C:\WINDOWS\enwyuy.exe
C:\WINDOWS\fgrdds.exe
C:\WINDOWS\Fonts\avzxomn.dll
C:\WINDOWS\Fonts\avzxost.exe
C:\WINDOWS\Fonts\jsqxcyc.dll
C:\WINDOWS\Fonts\jsqxczc.exe
C:\WINDOWS\Fonts\rarjfpi.dll
C:\WINDOWS\Fonts\rarjftl.exe
C:\WINDOWS\Fonts\rsjzbpm.dll
C:\WINDOWS\Fonts\rsjzbsp.exe
C:\WINDOWS\gxkvrk.exe
C:\WINDOWS\jbxtfo.exe
C:\WINDOWS\mzlafx.exe
C:\WINDOWS\owvykwmcw.exe
C:\WINDOWS\sgbcxx.exe
C:\WINDOWS\SYSTEM32\{03765FB0-9D62-4CF2-ACA4-0292DD0C7D68}.dat
C:\WINDOWS\SYSTEM32\acwluu.dll
C:\WINDOWS\SYSTEM32\andwwm.dll
C:\WINDOWS\SYSTEM32\auyghd.dll
C:\WINDOWS\SYSTEM32\bdnaim.dll
C:\WINDOWS\SYSTEM32\bvnjwp.dll
C:\WINDOWS\SYSTEM32\bxreyo.dll
C:\WINDOWS\SYSTEM32\cgiqpn.dll
C:\WINDOWS\SYSTEM32\cxniah.dll
C:\WINDOWS\SYSTEM32\dcczin.dll
C:\WINDOWS\SYSTEM32\dcjebp.dll
C:\WINDOWS\SYSTEM32\dikjbp.dll
C:\WINDOWS\SYSTEM32\djozjq.dll
C:\WINDOWS\SYSTEM32\dmjknp.dll
C:\WINDOWS\system32\DRIVERS\phy.sys
C:\WINDOWS\SYSTEM32\drtcuk.dll
C:\WINDOWS\SYSTEM32\egdqfx.dll
C:\WINDOWS\SYSTEM32\ehyxub.dll
C:\WINDOWS\SYSTEM32\eqfxeb.dll
C:\WINDOWS\SYSTEM32\fgmzxf.dll
C:\WINDOWS\SYSTEM32\foxusx.dll
C:\WINDOWS\SYSTEM32\fyduip.dll
C:\WINDOWS\SYSTEM32\gnunwl.dll
C:\WINDOWS\SYSTEM32\hfbcap.dll
C:\WINDOWS\SYSTEM32\hfoyyr.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\WINDOWS\SYSTEM32\iedjkw.dll
C:\WINDOWS\SYSTEM32\ilpipg.dll
C:\WINDOWS\SYSTEM32\ixspwk.dll
C:\WINDOWS\SYSTEM32\jhybak.dll
C:\WINDOWS\SYSTEM32\jrblgu.dll
C:\WINDOWS\SYSTEM32\juqkhb.dll
C:\WINDOWS\SYSTEM32\jvhjkx.dll
C:\WINDOWS\SYSTEM32\kdfdpm.dll
C:\WINDOWS\SYSTEM32\kdtzrx.dll
C:\WINDOWS\SYSTEM32\kuhqax.dll
C:\WINDOWS\SYSTEM32\lbjbjp.dll
C:\WINDOWS\SYSTEM32\lifycc.dll
C:\WINDOWS\SYSTEM32\muovux.dll
C:\WINDOWS\SYSTEM32\najiaa.dll
C:\WINDOWS\SYSTEM32\neukpb.dll
C:\WINDOWS\SYSTEM32\ngmjfw.dll
C:\WINDOWS\SYSTEM32\nijndn.dll
C:\WINDOWS\SYSTEM32\nkmnrq.dll
C:\WINDOWS\SYSTEM32\nophty.dll
C:\WINDOWS\SYSTEM32\nylsqy.dll
C:\WINDOWS\SYSTEM32\oewvhw.dll
C:\WINDOWS\SYSTEM32\ollhro.dll
C:\WINDOWS\SYSTEM32\pbatsa.dll
C:\WINDOWS\SYSTEM32\qexsjm.dll
C:\WINDOWS\SYSTEM32\qgkhxg.dll
C:\WINDOWS\SYSTEM32\qkehkb.dll
C:\WINDOWS\SYSTEM32\qmdnfd.dll
C:\WINDOWS\SYSTEM32\qnnlgq.dll
C:\WINDOWS\SYSTEM32\qqldkg.dll
C:\WINDOWS\SYSTEM32\qsewzd.dll
C:\WINDOWS\SYSTEM32\rbopga.dll
C:\WINDOWS\SYSTEM32\riavne.dll
C:\WINDOWS\SYSTEM32\rmacjf.dll
C:\WINDOWS\SYSTEM32\rrkddl.dll
C:\WINDOWS\SYSTEM32\sasesr.dll
C:\WINDOWS\SYSTEM32\sbztaw.dll
C:\WINDOWS\SYSTEM32\shjbqg.dll
C:\WINDOWS\SYSTEM32\sjillo.dll
C:\WINDOWS\SYSTEM32\svpvdm.dll
C:\WINDOWS\SYSTEM32\tduvwb.dll
C:\WINDOWS\SYSTEM32\tiqura.dll
C:\WINDOWS\SYSTEM32\tuzyrt.dll
C:\WINDOWS\SYSTEM32\ugtzef.dll
C:\WINDOWS\SYSTEM32\uvesfq.dll
C:\WINDOWS\SYSTEM32\uxelfq.dll
C:\WINDOWS\SYSTEM32\uzvjjj.dll
C:\WINDOWS\SYSTEM32\vdnhal.dll
C:\WINDOWS\SYSTEM32\vmlxwi.dll
C:\WINDOWS\SYSTEM32\vnamut.dll
C:\WINDOWS\SYSTEM32\vscwcr.dll
C:\WINDOWS\SYSTEM32\vvbcjl.dll
C:\WINDOWS\SYSTEM32\wnhipe.dll
C:\WINDOWS\SYSTEM32\wtajve.dll
C:\WINDOWS\SYSTEM32\wuoioo.dll
C:\WINDOWS\SYSTEM32\wxejys.dll
C:\WINDOWS\SYSTEM32\wzkzeg.dll
C:\WINDOWS\SYSTEM32\xexzoi.dll
C:\WINDOWS\SYSTEM32\xgqyin.dll
C:\WINDOWS\SYSTEM32\xnmqwu.dll
C:\WINDOWS\SYSTEM32\xntaew.dll
C:\WINDOWS\SYSTEM32\xvgacw.dll
C:\WINDOWS\SYSTEM32\ybtykw.dll
C:\WINDOWS\SYSTEM32\yiabnf.dll
C:\WINDOWS\SYSTEM32\ylitzv.dll
C:\WINDOWS\SYSTEM32\zibgjd.dll
C:\WINDOWS\SYSTEM32\zkcwbi.dll
C:\WINDOWS\SYSTEM32\zmlxfh.dll
C:\WINDOWS\vvrqitok.exe
.
The following files were disabled during the run:
C:\WINDOWS\system32\iqnauhc.dll
C:\WINDOWS\system32\nahzij.dll
C:\WINDOWS\system32\ijiq.dll

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\soS.Exe
C:\WINDOWS\{D30393F2-AD80-47FA-9F4C-49D575DDAC52}.dat
C:\WINDOWS\235780M.exe
C:\WINDOWS\bbaeki.exe
C:\WINDOWS\enwyuy.exe
C:\WINDOWS\fgrdds.exe
C:\WINDOWS\Fonts\avzxoin.dll
C:\WINDOWS\Fonts\avzxomn.dll
C:\WINDOWS\Fonts\avzxost.exe
C:\WINDOWS\Fonts\jsqxcss.dll
C:\WINDOWS\Fonts\jsqxcyc.dll
C:\WINDOWS\Fonts\jsqxczc.exe
C:\WINDOWS\Fonts\rarjfni.dll
C:\WINDOWS\Fonts\rarjfpi.dll
C:\WINDOWS\Fonts\rarjftl.exe
C:\WINDOWS\Fonts\rsjzbfg.dll
C:\WINDOWS\Fonts\rsjzbpm.dll
C:\WINDOWS\Fonts\rsjzbsp.exe
C:\WINDOWS\gxkvrk.exe
C:\WINDOWS\jbxtfo.exe
C:\WINDOWS\mzlafx.exe
C:\WINDOWS\owvykwmcw.exe
C:\WINDOWS\sgbcxx.exe
C:\WINDOWS\SYSTEM32\{03765FB0-9D62-4CF2-ACA4-0292DD0C7D68}.dat
C:\WINDOWS\SYSTEM32\acwluu.dll
C:\WINDOWS\SYSTEM32\andwwm.dll
C:\WINDOWS\SYSTEM32\auyghd.dll
C:\WINDOWS\SYSTEM32\bdnaim.dll
C:\WINDOWS\SYSTEM32\bvnjwp.dll
C:\WINDOWS\SYSTEM32\bxreyo.dll
C:\WINDOWS\SYSTEM32\cgiqpn.dll
C:\WINDOWS\SYSTEM32\cxniah.dll
C:\WINDOWS\SYSTEM32\dcczin.dll
C:\WINDOWS\SYSTEM32\dcjebp.dll
C:\WINDOWS\SYSTEM32\dikjbp.dll
C:\WINDOWS\SYSTEM32\djozjq.dll
C:\WINDOWS\SYSTEM32\dmjknp.dll
C:\WINDOWS\system32\DRIVERS\phy.sys
C:\WINDOWS\SYSTEM32\drtcuk.dll
C:\WINDOWS\SYSTEM32\egdqfx.dll
C:\WINDOWS\SYSTEM32\ehyxub.dll
C:\WINDOWS\SYSTEM32\eqfxeb.dll
C:\WINDOWS\SYSTEM32\fgmzxf.dll
C:\WINDOWS\SYSTEM32\foxusx.dll
C:\WINDOWS\SYSTEM32\fyduip.dll
C:\WINDOWS\SYSTEM32\gnunwl.dll
C:\WINDOWS\SYSTEM32\hfbcap.dll
C:\WINDOWS\SYSTEM32\hfoyyr.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\WINDOWS\SYSTEM32\iedjkw.dll
C:\WINDOWS\SYSTEM32\ilpipg.dll
C:\WINDOWS\SYSTEM32\ixspwk.dll
C:\WINDOWS\SYSTEM32\jhybak.dll
C:\WINDOWS\SYSTEM32\jrblgu.dll
C:\WINDOWS\SYSTEM32\juqkhb.dll
C:\WINDOWS\SYSTEM32\jvhjkx.dll
C:\WINDOWS\SYSTEM32\kdfdpm.dll
C:\WINDOWS\SYSTEM32\kdtzrx.dll
C:\WINDOWS\SYSTEM32\kuhqax.dll
C:\WINDOWS\SYSTEM32\lbjbjp.dll
C:\WINDOWS\SYSTEM32\lifycc.dll
C:\WINDOWS\SYSTEM32\muovux.dll
C:\WINDOWS\SYSTEM32\najiaa.dll
C:\WINDOWS\SYSTEM32\neukpb.dll
C:\WINDOWS\SYSTEM32\ngmjfw.dll
C:\WINDOWS\SYSTEM32\nijndn.dll
C:\WINDOWS\SYSTEM32\nkmnrq.dll
C:\WINDOWS\SYSTEM32\nophty.dll
C:\WINDOWS\SYSTEM32\nylsqy.dll
C:\WINDOWS\SYSTEM32\oewvhw.dll
C:\WINDOWS\SYSTEM32\ollhro.dll
C:\WINDOWS\SYSTEM32\pbatsa.dll
C:\WINDOWS\SYSTEM32\qexsjm.dll
C:\WINDOWS\SYSTEM32\qgkhxg.dll
C:\WINDOWS\SYSTEM32\qkehkb.dll
C:\WINDOWS\SYSTEM32\qmdnfd.dll
C:\WINDOWS\SYSTEM32\qnnlgq.dll
C:\WINDOWS\SYSTEM32\qqldkg.dll
C:\WINDOWS\SYSTEM32\qsewzd.dll
C:\WINDOWS\SYSTEM32\rbopga.dll
C:\WINDOWS\SYSTEM32\riavne.dll
C:\WINDOWS\SYSTEM32\rmacjf.dll
C:\WINDOWS\SYSTEM32\rrkddl.dll
C:\WINDOWS\SYSTEM32\sasesr.dll
C:\WINDOWS\SYSTEM32\sbztaw.dll
C:\WINDOWS\SYSTEM32\shjbqg.dll
C:\WINDOWS\SYSTEM32\sjillo.dll
C:\WINDOWS\SYSTEM32\svpvdm.dll
C:\WINDOWS\SYSTEM32\tduvwb.dll
C:\WINDOWS\SYSTEM32\tiqura.dll
C:\WINDOWS\SYSTEM32\tuzyrt.dll
C:\WINDOWS\SYSTEM32\ugtzef.dll
C:\WINDOWS\SYSTEM32\uvesfq.dll
C:\WINDOWS\SYSTEM32\uxelfq.dll
C:\WINDOWS\SYSTEM32\uzvjjj.dll
C:\WINDOWS\SYSTEM32\vdnhal.dll
C:\WINDOWS\SYSTEM32\vmlxwi.dll
C:\WINDOWS\SYSTEM32\vnamut.dll
C:\WINDOWS\SYSTEM32\vscwcr.dll
C:\WINDOWS\SYSTEM32\vvbcjl.dll
C:\WINDOWS\SYSTEM32\wnhipe.dll
C:\WINDOWS\SYSTEM32\wtajve.dll
C:\WINDOWS\SYSTEM32\wuoioo.dll
C:\WINDOWS\SYSTEM32\wxejys.dll
C:\WINDOWS\SYSTEM32\wzkzeg.dll
C:\WINDOWS\SYSTEM32\xexzoi.dll
C:\WINDOWS\SYSTEM32\xgqyin.dll
C:\WINDOWS\SYSTEM32\xnmqwu.dll
C:\WINDOWS\SYSTEM32\xntaew.dll
C:\WINDOWS\SYSTEM32\xvgacw.dll
C:\WINDOWS\SYSTEM32\ybtykw.dll
C:\WINDOWS\SYSTEM32\yiabnf.dll
C:\WINDOWS\SYSTEM32\ylitzv.dll
C:\WINDOWS\SYSTEM32\zibgjd.dll
C:\WINDOWS\SYSTEM32\zkcwbi.dll
C:\WINDOWS\SYSTEM32\zmlxfh.dll
C:\WINDOWS\vvrqitok.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_PHY
——-\phy

((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-03 23:20 . 2008-02-03 23:20 d——– C:\Documents and Settings\Stephen\Application Data\Malwarebytes
2008-02-01 17:39 . 2008-02-03 23:17 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-01-28 19:13 . 2008-01-28 19:13 29,184 –a—— C:\WINDOWS\SYSTEM32\ypaylj.dll
2008-01-27 22:06 . 2008-01-27 22:06 29,184 –a—— C:\WINDOWS\SYSTEM32\cmcsfa.dll
2008-01-27 20:28 . 2008-01-27 20:28 30,720 –a—— C:\WINDOWS\SYSTEM32\sazlln.dll
2008-01-27 20:28 . 2008-01-27 20:28 28,160 –a—— C:\WINDOWS\SYSTEM32\enobbc.dll
2008-01-27 20:26 . 2008-01-27 20:26 30,208 –a—— C:\WINDOWS\SYSTEM32\wsekux.dll
2008-01-27 20:25 . 2008-01-27 20:25 34,816 –a—— C:\WINDOWS\SYSTEM32\gakhwa.dll
2008-01-27 20:25 . 2008-01-27 20:25 31,232 –a—— C:\WINDOWS\SYSTEM32\hoxaya.dll
2008-01-27 19:24 . 2008-01-27 19:24 12,240 –a—— C:\WINDOWS\SYSTEM32\IGB_FY_1022.exe
2008-01-27 19:22 . 2008-01-27 19:22 12,063 –a—— C:\WINDOWS\SYSTEM32\IGB_TMZ_1025.exe
2008-01-27 19:20 . 2008-01-27 19:20 14,327 –a—— C:\WINDOWS\SYSTEM32\iqnauhc.dll.vir
2008-01-27 17:04 . 2008-01-27 17:04 30,720 –a—— C:\WINDOWS\SYSTEM32\mcwanm.dll
2008-01-27 17:04 . 2008-01-27 17:04 28,160 –a—— C:\WINDOWS\SYSTEM32\sbtvaa.dll
2008-01-27 17:02 . 2008-01-27 17:02 30,208 –a—— C:\WINDOWS\SYSTEM32\bmcinp.dll
2008-01-27 17:02 . 2008-01-27 17:02 29,184 –a—— C:\WINDOWS\SYSTEM32\gsyjhi.dll
2008-01-27 17:01 . 2008-01-27 17:01 34,816 –a—— C:\WINDOWS\SYSTEM32\qkonbp.dll
2008-01-27 17:01 . 2008-01-27 17:01 31,232 –a—— C:\WINDOWS\SYSTEM32\ojwwjs.dll
2008-01-27 16:59 . 2008-01-27 16:49 20,795 –a—— C:\WINDOWS\qcwqbt.exe
2008-01-27 16:52 . 2008-01-27 16:52 30,720 –a—— C:\WINDOWS\SYSTEM32\vzphpl.dll
2008-01-27 16:52 . 2008-01-27 16:52 28,160 –a—— C:\WINDOWS\SYSTEM32\kofxgm.dll
2008-01-27 16:51 . 2008-01-27 16:51 32,768 –a—— C:\WINDOWS\SYSTEM32\akwyiu.dll
2008-01-27 16:50 . 2008-01-27 16:50 30,208 –a—— C:\WINDOWS\SYSTEM32\fomohh.dll
2008-01-27 16:50 . 2008-01-27 16:50 29,184 –a—— C:\WINDOWS\SYSTEM32\bpiqde.dll
2008-01-27 16:49 . 2008-01-27 16:49 34,816 –a—— C:\WINDOWS\SYSTEM32\cvjfun.dll
2008-01-27 16:49 . 2008-01-27 16:49 31,232 –a—— C:\WINDOWS\SYSTEM32\wlhupz.dll
2008-01-27 16:47 . 2008-01-26 19:45 20,795 –a—— C:\WINDOWS\upwjqu.exe
2008-01-26 20:21 . 2008-01-27 19:22 12,283 –a—— C:\WINDOWS\SYSTEM32\IGB_ZX_1019.exe
2008-01-26 20:21 . 2008-01-27 19:23 12,187 –a—— C:\WINDOWS\SYSTEM32\IGB_WLWZ_1023.exe
2008-01-26 20:21 . 2008-01-26 20:21 12,125 –a—— C:\WINDOWS\SYSTEM32\IGB_WMGJ_1025.exe
2008-01-26 20:21 . 2008-01-27 19:23 12,076 –a—— C:\WINDOWS\SYSTEM32\IGB_GFSJ_1020.exe
2008-01-26 20:21 . 2008-01-26 20:21 11,360 –a—— C:\WINDOWS\SYSTEM32\IGB_TMZ_1023.exe
2008-01-26 20:20 . 2008-01-27 19:21 14,581 –a—— C:\WINDOWS\SYSTEM32\ijiq.dll.vir
2008-01-26 20:20 . 2008-01-27 19:20 14,314 –a—— C:\WINDOWS\SYSTEM32\nahzij.dll.vir
2008-01-26 20:20 . 2008-01-27 19:21 12,684 –a—— C:\WINDOWS\SYSTEM32\IGB_WD_1026.exe
2008-01-26 20:20 . 2008-01-27 19:20 12,214 –a—— C:\WINDOWS\SYSTEM32\IGB_DJOL_1019.exe
2008-01-26 20:20 . 2008-01-27 19:20 11,738 –a—— C:\WINDOWS\SYSTEM32\IGB_CQSJ_1008.exe
2008-01-26 20:20 . 2008-01-27 19:23 11,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\msaclue.sys
2008-01-26 20:20 . 2008-02-04 01:37 8,192 –ahs—- C:\WINDOWS\owvykwmcw.exe.hiv
2008-01-26 20:20 . 2008-02-01 17:32 7,168 –a—— C:\WINDOWS\SYSTEM32\msepion.sys
2008-01-26 20:20 . 2008-01-27 19:21 640 –a—— C:\WINDOWS\rtwlqvik.dat
2008-01-26 20:20 . 2008-02-04 01:37 42 –a—— C:\WINDOWS\czgcxswd.dat
2008-01-26 19:48 . 2008-01-26 19:48 28,160 –a—— C:\WINDOWS\SYSTEM32\somwga.dll
2008-01-26 19:47 . 2008-01-26 19:47 30,720 –a—— C:\WINDOWS\SYSTEM32\bacpbx.dll
2008-01-26 19:46 . 2008-01-26 19:46 32,768 –a—— C:\WINDOWS\SYSTEM32\zhzgod.dll
2008-01-26 19:46 . 2008-01-26 19:46 30,208 –a—— C:\WINDOWS\SYSTEM32\asvkkr.dll
2008-01-26 19:45 . 2008-01-26 19:45 34,816 –a—— C:\WINDOWS\SYSTEM32\enuzbg.dll
2008-01-26 19:45 . 2008-01-26 19:45 29,184 –a—— C:\WINDOWS\SYSTEM32\qeytbh.dll
2008-01-26 19:44 . 2008-01-26 19:44 31,232 –a—— C:\WINDOWS\SYSTEM32\kjpzvw.dll
2008-01-26 19:43 . 2008-01-26 18:41 20,795 –a—— C:\WINDOWS\pozals.exe
2008-01-26 18:42 . 2008-02-01 17:31 30,720 –a—— C:\WINDOWS\SYSTEM32\mstfhncn32.dll
2008-01-26 18:42 . 2008-02-01 17:32 10,240 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\msacpe.sys
2008-01-26 18:41 . 2008-02-01 17:30 34,457 –a—— C:\WINDOWS\SYSTEM32\5SvTh.exe
2008-01-17 13:33 . 2008-01-17 13:33 d——– C:\Documents and Settings\All Users\Application Data\CCP
2008-01-16 17:22 . 2008-01-16 17:22 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-01-16 17:22 . 2008-01-16 17:22 1,409 –a—— C:\WINDOWS\QTFont.for
2008-01-13 21:18 . 2008-01-13 23:23 d——– C:\Documents and Settings\Stephen\Application Data\GetRightToGo
2008-01-13 19:34 . 2008-01-13 19:34 d——– C:\Documents and Settings\Stephen\Application Data\Turbine
2008-01-13 15:33 . 2005-05-26 15:34 2,297,552 –a—— C:\WINDOWS\SYSTEM32\d3dx9_26.dll
2008-01-13 15:08 . 2008-01-13 15:08 d——– C:\Program Files\Codemasters
2008-01-12 12:44 . 2008-01-12 12:44 d——– C:\Program Files\PingPlotter Standard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 18:29 ——— d—–w C:\Documents and Settings\Stephen\Application Data\Skype
2008-02-01 17:29 ——— d—–w C:\Documents and Settings\Stephen\Application Data\AVG7
2008-02-01 17:28 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-02-01 00:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-27 17:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-01-03 14:51 ——— d—–w C:\Program Files\CCP
2007-12-29 19:53 ——— d—–w C:\Program Files\DivX
2006-06-18 10:42 44,872 —-a-w C:\Documents and Settings\Stephen\Application Data\GDIPFONTCACHEV1.DAT
2004-09-02 19:33 0 —ha-w C:\Documents and Settings\Stephen\hpothb07.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 07:56 158208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 07:56 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-27 17:19 219136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{7d8d71e0-e8db-4b7f-8236-2c2c91883044}"= C:\WINDOWS\system32\IGB_DJOL_1019.dll [ ]
"{a3d7c0d2-8c19-48c6-92c9-e1c0cccccd66}"= C:\WINDOWS\system32\IGB_CQSJ_1008.dll [ ]
"{76255dcf-d686-4d89-82d1-78fef7b3dc00}"= C:\WINDOWS\system32\IGB_WD_1026.dll [ ]
"{9807ac38-fd55-4c8f-9621-439ea7772f0d}"= C:\WINDOWS\system32\IGB_ZX_1019.dll [ ]
"{38bc7b80-9478-46e6-ab8b-51a671c74e26}"= C:\WINDOWS\system32\IGB_WMGJ_1025.dll [ ]
"{627a018a-1c4f-4e0e-9355-6f0cb21b0139}"= C:\WINDOWS\system32\IGB_WLWZ_1023.dll [ ]
"{7bd96c82-5433-42b1-b316-8a55c58b2b0f}"= C:\WINDOWS\system32\IGB_GFSJ_1020.dll [ ]
"{57034a0c-a6c1-4209-a47f-14c3b826dd1e}"= C:\WINDOWS\system32\IGB_TMZ_1025.dll [ ]
"{5900d1d4-2e8d-4dda-964d-4605477a98a8}"= C:\WINDOWS\system32\IGB_FY_1022.dll [ ]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WG111v2 Smart Wizard.lnk
backup=C:\WINDOWS\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
–a—— 2002-12-17 11:28 684032 C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
–a—— 2008-01-27 17:19 579072 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
–a—— 2003-08-29 03:59 122880 C:\WINDOWS\BCMSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
——— 2004-08-04 07:56 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2003-12-02 16:11 54296 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
–a—— 2003-12-02 16:11 58392 C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDet]
–a—— 2002-09-30 00:00 45056 C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 07:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
–a—— 2003-02-20 15:45 28672 C:\WINDOWS\SYSTEM32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
–a—— 2002-10-29 08:18 49152 C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDSentry]
-ra—— 2002-08-14 17:22 28672 C:\WINDOWS\System32\DSentry.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2006-02-23 15:45 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
–a—— 2003-08-18 16:46 53248 C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a—— 2005-04-01 15:16 5562368 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a—— 2005-04-01 15:16 86016 C:\WINDOWS\System32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2005-04-01 15:16 1495040 C:\WINDOWS\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
–a—— 2007-01-12 13:57 25367592 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
——— 2006-10-18 19:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe

R2 mseqsy;mseqsy;C:\WINDOWS\system32\DRIVERS\msacpe.sys [2008-02-01 17:32]
R2 msskye;msskye;C:\WINDOWS\system32\DRIVERS\msaclue.sys [2008-01-27 19:23]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 16:53]
S3 oflpydin;oflpydin;C:\DOCUME~1\Family\LOCALS~1\Temp\oflpydin.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{953398f6-825b-11dc-86ef-001060d0ebc6}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2008-02-04 02:00:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2004-09-01 21:27:54 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1071684436.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-01-18 20:47:53 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer.job"
- C:\PROGRA~1\NORTON~1\NAVW32.exeG/task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 02:41:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\RtlGina2.dll
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
.
**************************************************************************
.
Completion time: 2008-02-04 2:45:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-04 02:45:50
ComboFix2.txt 2008-02-04 01:43:29
.
2008-01-25 19:05:19 — E O F —

BlondieS

Post #55February 4, 2008, 3:19 AM UTC

Computer seems to be running normally

Date is right
Task manager is back
no 'new programs

IE still wont connect
AVG wouldn't update when I first downloaded it. But I will most likely uninstall it and try again once this is finished

HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 03:16:26, on 04/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ie\msntabres.dll.mui/229?b0be71b925ea4f759e530c9868bc7bf0
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ie\msntabres.dll.mui/230?b0be71b925ea4f759e530c9868bc7bf0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing)

BlondieS

Post #56February 4, 2008, 12:00 PM UTC

I was able to enbale my firewall and update AFG I still get a warning about the changes that we made in 'msconfig' And IE wont connect. But everything else seems perfect

LDTate

Post #57February 4, 2008, 6:36 PM UTC

I was able to enbale my firewall and update AFG

I still get a warning about the changes that we made in 'msconfig'

And IE wont connect. But everything else seems perfect

click Start> Run> type in Msconfig tap enter key.
look in the Startup.
Put the check back in for the ones we unchecked.

Reboot and let me know how it's running.

BlondieS

Post #58February 4, 2008, 11:47 PM UTC

After rebooting AVG updated I got a settings alert Symantec Intergrity of Synmantec product settings cannot be verified at this time…. Tried to open IE AVG gave 3 threat detected 'trojans' in a row First one I missed (30sec countdown) 2nd 2 I healed, both where windows/system32. One was tagged as PSWD.onlinegaming. IE still isnt connecting (That could be just something stupid on my part although it did work before)

LDTate

Post #59February 4, 2008, 11:51 PM UTC

Uninstall Internet Explorer 7 to return to Internet Explorer 6 on Windows XP Click "Start," and then click "Control Panel." Click "Add or Remove Programs." Check "Show Updates" at the top of the dialog box. Scroll down the list and highlight the version of Internet Explorer 7 that you are running, and then click "Change/Remove."

BlondieS

Post #60February 4, 2008, 11:57 PM UTC

It only has a 'remove' option not 'change/remove' Both updates where added after the virus started affect the computer. In fact I think I only updated to IE 7 because it was suggested on the 'Please Read' post in a number of forums Should I go ahead and remove it?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Task manager greyed out

✨ Ask AI

Ask AI